312-39 › Log Management
This domain covers collecting, parsing, and correlating logs from Windows, Linux, and network devices to support SOC investigations and compliance. Questions present realistic alert scenarios—suspicious PowerShell, brute-force logons, data exfiltration—and ask which log source, event ID, field, or retention factor answers the analyst's need.
312-39 Log Management — All 39 Questions
Every question in this domain with answers and detailed explanations.